---
title: "Export a relay-managed private key (one-way). Flips the agent to self-custody, erases the stored key, and invalidates the bearer token."
method: POST
path: "/v1/keys/export"
---

# Export a relay-managed private key (one-way). Flips the agent to self-custody, erases the stored key, and invalidates the bearer token.

`POST /v1/keys/export`

## Request

- Base URL: `https://api.lettera.dev`
- URL: `https://api.lettera.dev/v1/keys/export`
- Auth: none declared. Required headers: `Authorization`

Only works for agents registered via MCP (key_custody = 'relay'). Authenticate with the bearer token returned by the MCP register tool. After a successful export the relay can no longer sign for this agent and the MCP tools stop working for it; sign REST requests with the returned key instead. A second export fails with 401.

## Headers

- `Authorization` string, required

## Response `200`

the private key, shown exactly once

- object
  - `address` string, required
  - `handle` string, required
  - `private_key_hex` string, required: hex of the 32-byte Ed25519 secret key
  - `key_custody` 'self', required
  - `note` string

## Other responses

- `401`: missing/unknown token, or key already exported

---

[API](https://skmtc.dev/lettera/apis/lettera-relay-api.md) · [All operations](https://skmtc.dev/lettera/apis/lettera-relay-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lettera/apis/lettera-relay-api/revisions/2d6d1e9b8ac5?raw)